Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–75 of 162 matching · newest first
ServerFilters.DigestAuth / DigestAuthProvider defaulted to an always-true nonce verifier, disabling replay protection in default deploymentsMaven org.http4k:http4k-security-digest · Upgrade to 6.48.0.0, 5.42.0.0 or 4.51.0.0 by release line · >= 6.0.0.0, < 6.48.0.0; >= 5.0.0.0, < 5.42.0.0; < 4.51.0.0 · GHSA-c7jm-38gq-h67h
Maven org.http4k:http4k-core · Upgrade to 6.48.0.0, 5.42.0.0 or 4.51.0.0 by release line · >= 6.0.0.0, < 6.48.0.0; >= 5.0.0.0, < 5.42.0.0; < 4.51.0.0 · GHSA-pr33-38xx-6r26
HmacSha256.hash (despite the Hmac naming) computed a plain unkeyed digest; clarified by deprecation in favour of Sha256.hash / Sha256.hmacMaven org.http4k:http4k-core · Upgrade to 6.49.0.0 or later · < 6.49.0.0 · GHSA-m4w9-hjfw-vwj4
reverseProxy() defaulted to substring (Contains) matching on Host; tightened to ExactMaven org.http4k:http4k-core · Upgrade to 6.49.0.0, 5.42.0.0 or 4.51.0.0 by release line · >= 5.0.0.0, < 5.42.0.0; < 4.51.0.0; >= 6.0.0.0, < 6.49.0.0 · GHSA-jrpc-7vxp-69p6
Go github.com/traefik/traefik/v3 · Upgrade to 3.7.5 or later · >= 3.7.0-ea.1, <= 3.7.4 · CVE-2026-54762 · GHSA-4mr2-fg2p-w63c
Maven io.qameta.allure:allure-generator · Upgrade to 2.39.0 or later · <= 2.38.1 · CVE-2026-55847 · GHSA-gx93-m64w-5m6h
Maven io.qameta.allure:allure-commandline · Upgrade to 2.39.0 or later · <= 2.38.1 · CVE-2026-55846 · GHSA-82cg-3hv7-74gc
PyPI vcrpy · Upgrade to 8.2.1 or later · < 8.2.1 · GHSA-rpj2-4hq8-938g · amended
PyPI dbt-mcp · Upgrade to 1.20.0 or later · < 1.20.0 · CVE-2026-55837 · GHSA-jr33-mw75-7j8f · amended
PyPI ultimate-sitemap-parser · Upgrade to 1.8.1 or later · <= 1.8.0 · GHSA-p5wc-9w9r-m232 · amended
PyPI ultimate-sitemap-parser · Upgrade to 1.8.1 or later · <= 1.8.0 · GHSA-8823-qg2x-pv9f · amended
Go go.qbee.io/transport · Upgrade to 1.26.25 or later · < 1.26.25 · CVE-2026-55828 · GHSA-f9m7-vc86-p6jj
npm tinacms · Upgrade to 3.9.3 or later · < 3.9.3 · +1 more package · CVE-2026-55660 · GHSA-g5qx-h5f3-mp2f · amended
Packagist craftcms/commerce · Upgrade to 5.6.5 or 4.11.2 by release line · >= 5.0.0, <= 5.6.4; >= 4.0.0, <= 4.11.1 · CVE-2026-55795 · GHSA-h5gm-x9wr-vhcm
Packagist craftcms/commerce · Upgrade to 5.6.5 or 4.11.2 by release line · >= 5.0.0, <= 5.6.4; >= 4.0.0, <= 4.11.1 · GHSA-78vr-q6cf-c7p6
Packagist craftcms/cms · Upgrade to 5.10 or 4.18 by release line · >= 5.0.0-RC1, < 5.10; >= 4.0.0-RC1, < 4.18 · CVE-2026-55791 · GHSA-c55v-343g-5xff
npm @tinacms/cli · Upgrade to 2.4.3 or later · < 2.4.3 · CVE-2026-54074 · GHSA-4936-9hrh-qqpw · amended
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-55691 · GHSA-7h5p-637f-jfr7
Packagist starcitizenwiki/embedvideo · Upgrade to 4.1.0 or later · <= 4.0.0 · CVE-2026-55690 · GHSA-c29q-5xm7-5p62
npm flat-to-nested · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2026-55091 · GHSA-hp36-v28f-w3r4 · amended
npm @cyclonedx/cyclonedx-npm · Upgrade to 5.0.0 or later · >= 2.1.0, < 5.0.0 · CVE-2026-55849 · GHSA-v75r-vx73-82pj · amended
Go github.com/0xERR0R/blocky · Upgrade to 0.32.0 or later · >= 0.28.0, < 0.32.0 · GHSA-x845-2f78-7v36
PyPI ujson · Upgrade to 5.13.0 or later · <= 5.12.1 · CVE-2026-54911 · GHSA-3j69-69wj-xqx2 · amended
RubyGems concurrent-ruby · Upgrade to 1.3.7 or later · < 1.3.7 · CVE-2026-54906 · GHSA-6wx8-w4f5-wwcr
ReentrantReadWriteLock read-count overflow grants a write lock without exclusivityRubyGems concurrent-ruby · Upgrade to 1.3.7 or later · < 1.3.7 · CVE-2026-54905 · GHSA-wv3x-4vxv-whpp
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.